[TheCryptoDonkey]

Stacked on #89 (protocol and vectors); the base is that branch and GitHub will retarget it when #89 merges. Pairs with forgesworn/wildbloom#104 (the page).

Drop no longer needs the node to run a TURN issuer. It fails neither with no_turn nor before showing a link when there is none.

Changes (all under desktop/):

• messages.rs: IceServer::well_formed takes the two forms (any TURN URL: username and credential 1 to 256 bytes; STUN URLs only: both empty). The "no TURN URL" check is gone from the reader and from the encoder, which now refuses hide: true without a TURN URL instead, so Drop never sends a hidden invitation it cannot honour. New DEFAULT_STUN_URL = "stun:stun.cloudflare.com:3478" and default_stun(); a test pins the exact string (the page has the matching test) and that it names no ForgeSworn host.
• client.rs: the issuer reply parser accepts STUN-only entries with empty credentials and refuses a STUN-only entry with a credential, a TURN entry with an empty field, and so on.
• receive.rs: a 404 from the issuer becomes the built-in STUN entry for both ends (expires: 0, which a direct send does not read). With hiding on and no TURN URL it returns no_relay before open_pairing, so no link is made and no relay session is allocated. This is a small pure function, ice_for_receive, with unit tests for each answer. no_turn is removed.
• The hide setting defaults to off for installs that never set it (stored on stays on, stored off stays off). Settings status, app.js, drop.js and the test stub follow. This is the owner-decided flip.
• session.rs: a session that never connects reports connect_direct instead of connect when no TURN URL was on offer.
• UI copy and DROP-IPC.md: no_turn removed; no_relay now points to Settings; connect_direct added ("...Some networks, like mobile data or work Wi-Fi, don't allow it. Nothing was kept.").
• Vendored bundle rebuilt with scripts/vendor-direct.mjs from forgesworn/wildbloom feat/direct-stun-page at e04bdef (the page code commit). The provenance names that commit. If #104 is squash-merged, rebuild from the merge commit before releasing Drop (node scripts/vendor-direct.mjs --checkout ../wildbloom --commit <sha>).

Tests run (local, macOS): cargo test --locked --manifest-path desktop/src-tauri/Cargo.toml (after fixing one harness assertion of mine; the run that failed was my own new test), then the drop:: tests again after cargo fmt; cargo clippy --all-targets -D warnings on the desktop crate; node desktop/tests/drop-ui.mjs (71 scenarios), node desktop/tests/direct-window.mjs (15, including a new one that a STUN-only server reaches RTCPeerConnection with no username or credential member); vendor-direct.mjs --check --checkout rebuilds byte for byte. pools-ui.mjs and the native acceptance scripts were not run.

Spec deviations: the session tests for "404 gives the default invite" and "hide on plus 404" are unit tests of ice_for_receive plus the harness test for connect_direct; a full open_receive test needs a live node and device identity (the e2e harness), which I did not extend. The Drop release, the hide-default flip going out, and signing remain owner decisions; nothing is released or tagged.

[TheCryptoDonkey]

Included in #89, which carries these commits and was squash-merged to main.